Security device data communication protocol defended by collaborative network

Abstract

The invention discloses a security device data communication protocol for collaborative network defense, and belongs to the technical field of network defense. The communication protocol provided by the invention is used for coordinating data communication between a network defense command creator and a network defense command receiver; the communication protocol is characterized in that after thenetwork defense command creator receives the defense means, a network defense command is created according to the communication protocol, and sent to the network defense command receiver, a network defense command response aiming at the received network defense command is created according to the communication protocol after the network defense command receiver successfully receives the network defense command, and sent back to the network defense command creator; in this communication protocol, the network defense command receiver is a security device. The protocol deals with infinite network threats by keeping the updating of the protocol content, and has the advantages of flexible change, accurate content and no ambiguity.

Description

technical field [0001] The invention belongs to the technical field of network defense, and in particular relates to a data communication protocol of a security device for cooperative network defense. Background technique [0002] Today, cyber defense systems leverage cyber threat intelligence sharing to detect and contain vulnerabilities before attackers start exploiting them. Mature foreign threat intelligence standards include network observable expressions (CyboX), structured threat information expressions (StructuredThreatInformationeXpression, STIX) and trusted automated exchange of indicator information (TrustedAutomatedeXchangeofIndicatorInformation, TAXII), STIX specification can describe many aspects of threat intelligence characteristics, including threat factors, threat activity, security incidents, etc., TAXII is used to transmit threat intelligence. Users will be able to pass anonymous data to their security providers, and security providers will be able to qu...

AI Technical Summary

Problems solved by technology

[0003] The goal of these specifications is to share network intelligence, but it is far from enough to share network intelligence with major security vendors

In recent years, with the continuous update and faster spread of network threats, even if the existing defense system can quickly receive network threat intelligence, it is different from the analysis timeliness of different security devices. Response, can handle unpredictable

Images